trademark

9.0
Granular Audits
It is a best practice to perform granular audits. This is primarily due to the possibility
that users may miss true positive alerts from a real-time security monitoring system that
may warn them of an attack. The following best practices should be followed in regard to
establishing a system for granular audits.
9.1 Create a cohesive audit view of an attack
9.1.1 Why?
To answer essential questions following an attack. As an attack may consist of different
stages (e.g., a reconnaissance scan, followed by a vulnerability attack, etc.), it is important
to get all the pieces of the puzzle collected and put into their respective places. In only
this way can a cohesive view be established. It is important to build up a consistent and
cohesive audit trail that answers basic questions, including: what happened? when did it
happen? how did it happen? who was the perpetrator? and why did it happen?
9.1.2 How?
• Enable auditing capabilities in a big data infrastructure.
• Select the relevant capabilities depending on features of infrastructure components, such
as log information from routers, applications, operating systems (OS), databases, and so on.
• Use a SIEM solution, as well as audit and forensics tools to process the collected audit
information.
9.2 Evaluate completeness of information
9.2.1 Why?
To provide a full audit trail. All relevant information that builds up the trail has to be
available. As such, completeness of information is key.
9.2.2 How?
• Evaluate which audit information might be relevant upfront and which audit information
is available in general. This data may come from log files, OS settings and profiles, and
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
48